Pre-requisites

1. Annual Contract Agreement with First Orion Branded Communications (Post paid)
2. Access to First Orion Customer Portal
3. Vetted and Approved Business
4. Cisco Unified Call Manager
5. Desk Phone or Softphone
6. Appropriate access to DNS provider
7. Fully qualified domain (FQDN)

Expectations

1. SIP over TLS

Configuration Pre-requisites

• All CUCM nodes running the Call Manager service that will have SIP trunks to the Call
  Authentication service will require internet access to reach the First Route service
  endpoint. IPs and ports for firewall whitelisting will be provided upon request.

• The Call Authentication service via SIP prefers the calling and called party numbers in the
  SIP invite to be in 10 digit, 11 digit, or e.164 format. Transformation or translations should
  be performed prior to Call Authentication SIP Trunk call routing.
• Encryption is required using either TLS or mTLS.
  • First Orion will provide the Call Authentication certificate chain to be added to the
    Callmanager-trust.
  • For mTLS, First Orion will also need the certificate chain or root certificate for each
    Call Manager node that will connect to the Call Authentication service.

Solution Overview

The following diagram illustrates the high-level call flow to deliver Call Authentication originating
from CUCM with example 417 SIP response code.

Testing

Thorough testing is required when configuring a new SIP trunk for customers. Based on industry
standards, following scenarios should be confirmed.

CUCM Configuration

Upload First Orion Root Certificates to CUCM Trust Stores

1. In the Cisco Unified OS Administration portal, go to Security > Certificate Management.
2. Click on Upload Certificate/Certificate chain.
3. For Certificate Purpose, select CallManager-trust.
4. (optional) Fill in the Description(friendly name) field.
5. Click Choose File and select the root certificate provided by First Orion.
6. Click Upload.
7. If there are multiple clusters, repeat steps 1-5 on a CallManager node in each cluster.

SIP Trunk Security Profile

1. In the CUCM Administration portal, go to System > Security > SIP Trunk Security
   Profile.
2. Click on Add New.
3. Fill in the Name and Description fields.
4. For Device Security Mode, select Encrypted.
5. Ensure Incoming Transport Type and Outgoing Transport Type updated to TLS.
6. Incoming Port will be 5061 by default.
   1. Non-standard ports may be used for SIP-TLS connections at the customer’s
      request.
7. Leave remaining fields in their default values.
8. Save the changes.

SIP Profile

1. In the CUCM Administration portal, go to Device > Device Settings > SIP Profile.
2. Copy the default Standard SIP Profile.
3. Update the Name and Description fields as needed.
4. Enable SIP OPTIONS Ping, using the default timer values.
5. Leave the rest of the fields in their default values.
6. Save the changes.

SIP Trunk

1. In the CUCM Administration portal, go to Device > Trunk.
2. Click Add New.
3. On the first Trunk Configuration page, use the following values:
   1. Trunk Type
      1. SIP Trunk
   2. Device Protocol
      1. SIP
   3. Trunk Service Type
      1. None(Default)

4. Click Next
5. Update the Name and Description fields as needed.
6. Select a Device Pool based on your configuration needs.
7. Select a Location based on your configuration needs.
8. Ensure Media Termination Point Required is NOT checked.
9. It is recommended that Run On All Active Unified CM Nodes is checked for redundancy.
   1. If activating this feature on the Call Authentication SIP trunk, it is also
      recommended to activate this feature for any Route List that contains a Route
      Group utilizing this trunk in its configuration.
   2. To better understand this use case, reference the following Cisco forum posts:
      1. "Run on all active unified CM Nodes" on CUCM
      2. SIP TRUNKS and RUN on ALL ACTIVE CM NODES
10. In the SIP Information section, use the following values:
    1. Destination Address
       1. FQDN provided by First Orion team
    2. SIP Trunk Security Profile
       1. Secure TLS Profile created previously
    3. SIP Profile
       1. Profile created previously
11. Save the changes.

Mutual TLS(mTLS) Considerations

To implement mTLS, First Orion will need the root certificate of the CallManager service
identity certificate for each Publisher and Subscriber that will connect to Call Authentication.
Depending on CUCM configuration, First Orion may also need the root certificate for the ECDSA
identity certificate.

Determining CallManager Service Certificate Type

1. In the Cisco Unified OS Administration portal, go to Security > Certificate Management.
2. Use the query of:
   a. Find Certificate List where Usage begins with Identity
3. Click Find.
4. Find the rows with CallManager and CallManager-ECDSA in the Certificate column and
   ensure the Usage column also contains Identity.

Identity certificates will fall into two broad categories: Self-Signed and Third-Party Signed.

• Self-signed certificates are signed by the server that presents it, so its “root” is itself. The
  Common Name and Issued By fields will be the same.
• Third-Party signed certificates are signed by either a public Certificate Authority (like Verisign,
  Entrust, or Digicert) or a private Certificate Authority (like Windows, Linux, Unix, or IOS). The
  Common Name and Issued By fields will be different.

Self-Signed

If the identity certificate is self-signed, First Orion will need a copy. To download a copy of the
self-signed certificate:

1. In the Cisco Unified OS Administration portal, go to Security > Certificate Management.
2. Use the query of:
   1. Find Certificate List where Usage begins with Identity
3. Click Find.
4. Find the row CallManager in the Certificate column and ensure the Usage column also
   contains Identity.
5. Click on the hyperlink in the Common Name/Common Name_SerialNumber column.
6. Click Download .PEM File.
   Repeat steps 4-6 for the CallManager-ECDSA certificate.
   Repeat steps 1-7 on each Publisher and Subscriber running the CallManager service in
   your environment, especially if you have multiple clusters.

Third-Party Signed

If the Identity certificate is signed by a third-party CA, First Orion will need a copy of the Root
CA’s certificate in .PEM format. First Orion only needs one copy of each unique root CA.

• For public CAs, the root certificate can usually be found on the company’s website.
• For private CAs, talk to the admin who runs your CA, probably in your internal IT department.

Call Routing

The Call Authentication service entry needs to be first in the call routing list. There are multiple
ways this can be accomplished, and due to the complexity of CUCM’s configuration possibilities,
we leave it to the customer’s telephony engineer to decide which works best for their
environment. Due to the recursive nature of the SIP Call Authentication service, we strongly
recommend using route lists and route groups as the destination for “OffNet” route patterns
within the context of Call Authentication.

Make Phone Calls

Test phone calls from your Cisco phone numbers that have been added to a Call Auth Program.

Troubleshoot Checklist

1. Verify First Orion and your Cisco CUCM are connected.
2. Verify phone numbers are in Call Authentication Program.